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Summary 


Section 48 of the Freedom of Information Act (FOIA) empowers the information Commissioner (the Commissioner) to issue a 
practice recommendation where it appears to him that a public authority has failed to conform, specifically, to the FOIA 
Codes of Practice. These failures are addressed in the recommendations section below. Section 47 of FOIA also makes clear 
that the Commissioner has a duty to promote the following of good practice beyond just the requirements of the Codes of 
Practice. The wider concerns the Commissioner has in this case are addressed in the “Other matters” section below to keep 
them distinct from the Section 48 related recommendations he has made. 


In respect of the FOIA cases submitted to him for a decision, the Department for Work and Pensions (DWP) has had a 
consistently poor level of performance in terms of its request handling, specifically in relation to determining whether 
information is held and the conduct of internal reviews. This has been highlighted in those cases where it has been necessary 
for the Commissioner to intervene in order to ensure DWP’s compliance with FOIA. 


Following engagement by his staff with DWP about the underlying reasons for these failings, the Commissioner has reached 
the view that DWP’s request handling practices do not conform to parts 1, 5 and 10 of the section 45 Freedom of Information 
Code of Practice, issued by the Cabinet Office in July 2018 (the Code). 


Recommendations 


The Commissioner has been engaging with DWP regarding his concerns about its request handling. During this 
correspondence, DWP confirmed to the Commissioner the improvements already made to its request handling, namely that 
the Central FOI Team (CFOIT) now reviews all responses and internal reviews to ensure compliance with FOIA. The 
Commissioner has therefore designed the following recommendations to support and enhance DWP’s improvements to its 
information rights practices. 


In considering these recommendations, we expect DWP to ensure that it meets the requirements of all information rights 
legislation to which it is subject. 
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Area of Code Non-conformity Recommendation of steps to be taken 


Section 1 of the Section 
45 Code of Practice 


A direct consequence of the 
requirement of section 1 of the 
Section 45 Code of Practice is the 
Section 1.1 of the Code sets need for a public authority to 

out requesters’ right to be adequately and precisely “scope” 
informed whether or not the the request. Put another way, the 
public authority “holds public authority must read the 
information meeting the request and ask itself “what, 
description set out in the | precisely, is being requested?”. 
request” [emphasis 
added]. The Commissioner has noted a 
pattern of requests brought to him 
in which DWP has failed to correctly 
interpret the request, locate all of 
the information falling within the 


scope of the request or has failed to | 


confirm what information, if any, is 
held. 


DWP should ensure that staff are sufficiently trained 


_and aware of its procedures and practices in order to 
| provide responses that fully comply with FOIA and the 


section 45 Code of Practice. DWP should ensure that 
responses pay careful attention to the wording of 
requests for information and be sure to discharge its 
obligation to confirm whether the requested 
information is or is not held, assuming a “neither 
confirm nor deny” response is not being issued. 


DWP should request a consensual audit of the DWP’s 
FOIA policies and practices and procedures from the 
ICO; 


DWP should undertake a self-assessment via his 
online Toolkit, in particular Topic 1, modules 2 & 3 
request handling and training. DWP should then 
implement any changes required following the 
outcome of the self-assessment. 
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Area of Code Non-conformity 


Section 5 of the Section The Commissioner has noted a 
45 Code of Practice trend in DWP’s internal reviews to 
simply repeat the arguments set 
Section 5.8 of the Code sets out in the refusal notice. This 


| out that internal reviews appears to be particularly prevalent 

| should provide “a fair and in cases where DWP has relied on 

| thorough review” of relevant section 35(1)(a) or any of the limbs 
matters. of section 36. 


The Commissioner also notes that 
where procedural errors occur, 
these are not always rectified at 
internal review, suggesting a lack of 
a thorough reconsideration of the 
request. 


Recommendation of steps to be taken 


DWP should ensure that internal reviews are carried 
out in a “fair and thorough” manner. In order to 
ensure that this happens consistently, DWP should 
refresh its procedures for carrying out internal reviews 
and ensure that these are effective and robust. 


Area of Code Non-conformity 


Section 10 of the Section The Commissioner has noted the 
45 Code of Practice persistent use of standard 
templates in DWP’s refusal notices, 


Section 10.2 of the Section | particularly where DWP is relying on | 


45 Code of Practice sets out | section 12, section 35(1)(a) or any 


Recommendation of steps to be taken 


DWP should ensure that it responds fully to each 
request and that it provides the details and 
information required by sections 1 and 17 of FOIA. 


DWP should ensure that it does not solely rely on 
standard template responses and provides details on 
why the specific information requested is not held or 


what exactly should be of the limbs of section 36. DWP 

included in any initial routinely fails to specify the nature 

response to a request for of the prejudice envisaged under cannot be disclosed including the specific 
_information under FOIA. section 36(2)(c). circumstances surrounding the request. 
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The relevant requirements 
are: 


Confirmation that the 
requested information is 
held or not held by the 
public authority or a 
statement neither 
confirming or denying 
whether the information is 
held; 


If some or all of the 
information cannot be 
disclosed, details setting out 
why this is the case, 
including the sections (with 
subsections) the public 
authority is relying on if 
relevant. When explaining 
the application of named 
exemptions, however, public 
authorities are not expected 
to provide any information 
which is itself exempt. 


The Commissioner considers that 
the use of standard wording does 
not provide the requester with 
details setting out why the 
particular request cannot be 
complied with or why the 
information requested cannot be 
disclosed. The Commissioner 
expects refusal notices to include 
specific explanations for why an 
exemption is engaged and public 
interest considerations based on the 
specific circumstances of the 
request. 


DWP also routinely fails to specify 
the subsection engaged, particularly 
when citing sections 12, 31 and 43. 


Where issuing a section 12(1) or (2) response, DWP 
should ensure that it provides the requester with 
details of why the request would exceed the 
appropriate limit. 
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Reasons for issuing this Practice Recommendation 


Through the evidence provided in a series of complaints, it appears that the handling of information requests within DWP has 
fallen below the expectations set out in the Section 45 Code of Practice. The Commissioner has set out examples of this in an 
annex at the end of this practice recommendation. The impression created by this evidence has been added to by the 
Commissioner’s own experience of dealing with DWP. This is discussed in further detail in the “Other matters” section of this 
recommendation. 


This practice recommendation formalises the Commissioner’s concerns and holds DWP accountable for improving certain 
freedom of information request handling practices and, in turn, increase public confidence and trust in that regard. The 
purpose of this practice recommendation is to provide DWP with a constructive learning tool following which it can improve 
the areas of concern set out in this document. 


Other Matters 


The Commissioner acknowledges DWP’s recovery from the difficulties encountered during the Covid pandemic which had a 
particular impact on it. DWP were required to redeploy staff from across the department to aid with the task of processing 
millions of new claims. DWP has confirmed to the Commissioner that it has recently seen an improvement in FOI processing 
and the Commissioner notes that in the latest Cabinet Office FOI statistics bulletin, DWP responded within the statutory 
timeframe in 98% of the requests received'. The Commissioner is also mindful of the CFOIT’s excellent engagement with his 
officers which aids his investigations. 


However, the Commissioner has noted an increase in the number of complaints to him resulting in decisions ordering DWP to 
disclose the requested information. In its recent correspondence with the Commissioner, DWP stated that it had noted the 
Commissioner’s change in position regarding the weight of the public interest in disclosure. The Commissioner respectfully 
disagrees that the increase in decisions requiring disclosure is due to a change in his approach. The Commissioner considers 


1 https://www.gov.uk/government/statistics/freedom-of-information-statistics-july-to-september-2022/freedom-of-information-statistics-july-to-september-2022-bulletin- 
-2 
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that there has been an increase in the amount of information being withheld by DWP where previously this information would 
have been disclosed or proactively published. The Commissioner notes that DWP has refused to disclose several research 
papers with one refusal to disclose resulting in the Committee for Work and Pensions using its Parliamentary powers to 
obtain the NatCen Report on The Uses of Health and Disability Benefits and publish this?. 


The Commissioner considers that, increasingly, cases are being brought to him where the public interest in disclosure is not 
being adequately considered. The nature and importance of DWP’s responsibilities means that there is inherently a high 
public interest in disclosure of information held in the context of the vulnerable nature of the members of the public 
financially dependent upon it and the large amount of public money which funds the department and the benefits paid out. 


As set out above, the Commissioner has been engaging with DWP regarding his concerns about request handling and as part 
of this correspondence DWP confirmed that it intended to undertake a review of its FOI training. The Commissioner allowed 
time for this review to occur and changes to be implemented. He recently asked DWP to provide him with details of the 
outcome of the review and changes made. 


DWP confirmed that it had undertaken a light-touch exercise looking at its training needs and guidance material and as it 
was light-touch, no formal plan or report was produced. DWP confirmed that it had decided to offer refresher training based 
on the Central FOI team’s (CFOIT) working interactions with teams across DWP, including where it was noted that similar 
errors were cropping up, where there were new staff and where staff wanted a refresher course. DWP confirmed that it was 
continuing to evaluate training needs based on CFOIT’s interaction with teams. 


However, DWP confirmed that there is no mandatory training that staff are required to undertake. Staff responding to 
requests under FOIA are not required to undertake any training or refresher training, although training, guidance and advice 
is available to them should they request it. Staff are also not provided with mandatory training confirming how to recognise a 
request for recorded information. 


The Commissioner is concerned that DWP is not ensuring that staff are suitably trained to recognise requests and, where 
appropriate, respond to these requests. Whilst the Commissioner acknowledges that training and guidance resources are 
available to those that request them, he considers that DWP is failing to ensure that all staff have a minimum level of 
knowledge and training in the recognition and actioning of requests under FOIA. 


2 https://committees.parliament.uk/committee/164/work-and-pensions-committee/news/160750/disabled-peoples-experiences-of-the-benefits-system-committee- 
publishes-governmentcommissioned-research/ 
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Having engaged with the DWP during his investigations, the Commissioner considers that the CFOIT has extensive 
knowledge and experience of FOIA and its application. The Commissioner recommends that DWP uses this resource to 
ensure that the wider DWP is proactively equipped to recognise and respond to requests rather than waiting for recurrent 
issues to present themselves through ICO investigations. 


Failure to comply 


A practice recommendation cannot be directly enforced by the Commissioner. However, failure to comply with a practice 
recommendation may lead to a failure to comply with FOIA, which in turn may result in the issuing of an enforcement notice. 
Further, a failure to take account of a practice recommendation may lead in some circumstances to an adverse comment in a 
report to Parliament by the Commissioner. 


DWP should write to the Commissioner by the end of 23 June 2023 to confirm that it has complied with his 
recommendations and how it has achieved this. 


The Commissioner will have regard to this practice recommendation in his handling of subsequent cases involving DWP. 
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Annex: Evidence 


In one case?, DWP responded to a request by confirming that where personal data or personal information of deceased 
individuals is requested, this is exempt under section 40 and 41. DWP failed to confirm the correct subsection and therefore 
whether it held the requested information or whether it was neither confirming or denying that it held the information. DWP 
then confirmed to the Commissioner during his investigation that it was neither confirming nor denying holding the 
information despite the request confirming that in another previous request, DWP had confirmed holding the information. 


In several cases* requesting information on the decision not to extend the £20 uplift to Universal Credit to Disability Benefits, 
DWP failed to locate all of the information falling within the scope of the request until one of the cases was at appeal to the 
First Tier Tribunal and the remaining cases were at investigation stage with the Commissioner. DWP originally only 
considered the formal documents falling within the scope of the request. 


In one case’, DWP failed to confirm or deny whether it held a requested piece of analysis over several requests, instead 
providing explanations of how the analysis was undertaken and links to related information. At internal review, DWP failed to 
acknowledge that it had not confirmed whether it held the requested information and relied on sections 14(1) and 14(2) to 
refuse to comply with the request. Following the Commissioner’s investigation, DWP was required to issue a fresh response 
confirming whether or not it held the requested information. 


In another case®, in response to a clear request for recorded information, DWP advised that FOIA does not require a public 
authority to create information and that where a question is asked, public authorities should provide the recorded 
information held that best answers the question. DWP then provided an explanation and failed to confirm whether it held the 
specific requested information. The internal review upheld the original response but stated that it confirmed that the 
information was not held. Following the Commissioner’s intervention, DWP issued a revised response confirming that it did 
hold the information. 


3 https://ico.org.uk/media/action-weve-taken/decision-notices/2022/4022756/ic-124082-g7t7.pdf 

* https://ico.org.uk/media/action-weve-taken/decision-notices/2022/4020198/ic-55806-h6r8.pdf & https://ico.org.uk/media/action-weve-taken/decision- 
notices/2022/4020053/ic-82880-s7k3.pdf 

5 https://ico.org.uk/media/action-weve-taken/decision-notices/2022/4020067/ic-92562-s2p6.pdf 

€ https://ico.org.uk/media/action-weve-taken/decision-notices/2022/4019385/ic-735 70-v7p3.pdf 
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In a further case’, a request for the email addresses by which DWP could be contacted was responded to by stating that 
section 21 was engaged and providing a link to DWP’s ‘Contact Us’ webpage which did not contain any email addresses. At 
internal review, DWP stated that its original use of section 21 was correct but it should have confirmed that section 36 was 
engaged for the remaining information. DWP failed to correctly identify what information was being requested. 


The Commissioner received a complaint regarding a request for the latest version of a set of minutes® and DWP denied 
holding the requested information because the minutes had not yet been finalised. DWP upheld this position at internal 
review. 


The Commissioner has noted that in one case®, DWP confirmed that it held the requested information and stated that it was 
withholding the information under section 31(1)(a). The internal review upheld this position, however, following the 
Commissioner’s intervention, DWP confirmed that the information was not held and the original refusal notice was sent 
following an internal error. The internal review in fact upheld the use of section 31(1)(a) to information that did not fall 
within the scope of the request. 


DWP again failed to locate all of the information falling within the scope of a request for the recommendations made in 
Internal Process Reviews and the tracked progress in implementing them?°. DWP identified the recommendations but stated 
that the tracked progress would be published in its annual report. During the Commissioner’s investigation, DWP directed the 
complainant to its annual report which provided only a brief summary of the work surrounding Internal Process Reviews. The 
Commissioner was required to return to DWP on several occasions before DWP confirmed what information was held. 


DWP failed to correctly interpret a request for the ‘data and insights into the top areas of customer’s concerns’ previously 
confirmed to have been collated in a Parliamentary Written Question. The complainant confirmed what they would expect to 
receive in their request for internal review. DWP originally withheld the information under section 35(1)(a) but during the 
Commissioner’s investigation confirmed that due to the passage of time, it would be content to disclose the information. At 
this point, DWP provided only the breakdown of the top areas of concern rather than the information held that led to this*?. 


7 Complaint did not result in a decision notice. 

8 https://ico.org.uk/media/action-weve-taken/decision-notices/2023/4023837/ic-206199-w8x8. pdf 
° https://ico.org.uk/media/action-weve-taken/decision-notices/2022/4022747/ic-111848-d1q7.pdf 
10 https://ico.org.uk/media/action-weve-taken/decision-notices/2023/4024207/ic-117969-p7c1.pdf 
11 1C-162284-M3N9 Decision Notice issued but not published at time of Practice Recommendation 


